AWS IoT 物联网系列， 第一篇：利用 Lambda 实现 IoT 设备证书的即时注册 (Just-In-Time Registration)

$ mkdir cert$ cd cert$ openssl genrsa -out CA_Private.key 2048$ openssl req -x509 -new -nodes -key CA_Private.key -sha256 -days 365 -out CA_Certificate.pem

$ aws iot get-registration-code

$ openssl genrsa -out Verification_Private.key 2048$ openssl req -new -key Verification_Private.key -out Verification.csr

$ openssl x509 -req -in Verification.csr -CA CA_Certificate.pem -CAkey CA_Private.key -CAcreateserial -out Verification.crt -days 365 -sha256

$ aws iot register-ca-certificate --ca-certificatefile://CA_Certificate.pem --verification-certificate file://Verification.crt --set-as-active --allow-auto-registration

$ openssl genrsa -out Device.key 2048$ openssl req -new -key Device.key -out Device_Certificate.csr

$ openssl x509 -req -in Device_Certificate.csr -CA CA_Certificate.pem -CAkey CA_Private.key -CAcreateserial -out Device_Certificate.crt -days 365 -sha256

{
"certificateId": "<certificateID>",
"caCertificateId": "<caCertificateId>",
"timestamp": "<timestamp>",
"certificateStatus": "PENDING_ACTIVATION",
"awsAccountId": "<awsAccountId>",
"certificateRegistrationTimestamp": "<certificateRegistrationTimestamp>"
}

{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "logs:CreateLogGroup",        "logs:CreateLogStream",        "logs:PutLogEvents"      ],      "Resource": "arn:aws-cn:logs:*:*:*"    },    {      "Effect": "Allow",      "Action": [        "iot:UpdateCertificate",        "iot:CreatePolicy",        "iot:AttachPrincipalPolicy"      ],      "Resource": "*"    }  ]}

/** This node.js Lambda function code creates and attaches an IoT policy to the just-in-time registered certificate. It also activates the certificate. The Lambdafunction is attached as a rule engine action to the registration topic $aws/events/certificates/registered/<caCertificateID>**/
var AWS = require('aws-sdk');
exports.handler = function (event, context, callback) {
  // 根据实际部署区域写入，在certificateARN一处也是。  var region = "cn-north-1";  var accountId = event.awsAccountId.toString().trim();  var iot = new AWS.Iot({    'region': region,    apiVersion: '2015-05-28'  });
  var certificateId = event.certificateId.toString().trim();
  //这里你可以替换成你想要的topic名称  var topicName = `JITR/test`;  var certificateARN = `arn:aws-cn:iot:${region}:${accountId}:cert/${certificateId}`;  var policyName = `Policy_${certificateId}`;  //定义Policy并赋予权限，允许IoT设备连接，发布，订阅和接受消息  var policy = {    "Version": "2012-10-17",    "Statement": [      {        "Action": [          "iot:Publish",          "iot:Subscribe",          "iot:Connect",          "iot:Receive"        ],        "Effect": "Allow",        "Resource": [          "*"        ]      }    ]  };
  /*  创建Policy  */  iot.createPolicy({
    policyDocument: JSON.stringify(policy),    policyName: policyName  }, (err, data) => {
    //Ignore if the policy already exists    if (err && (!err.code || err.code !== 'ResourceAlreadyExistsException')) {      console.log(err);      callback(err, data);      return;    }    console.log(data);    /*    附加Policy到设备证书上    */    iot.attachPrincipalPolicy({
      policyName: policyName,      principal: certificateARN    }, (err, data) => {
      //Ignore if the policy is already attached      if (err && (!err.code || err.code !== 'ResourceAlreadyExistsException')) {        console.log(err);        callback(err, data);        return;      }      console.log(data);      /*      激活证书      */      iot.updateCertificate({        certificateId: certificateId,        newStatus: 'ACTIVE'      }, (err, data) => {        if (err) {          console.log(err, err.stack);          callback(err, data);        } else {          console.log(data);          callback(null, "Success, created, attached policy and activated the certificate " + certificateId);        }      });    });  });}

$ sudo wget http://download.opensuse.org/repositories/home:/oojah:/mqtt/CentOS_CentOS-7/home:oojah:mqtt.repo -O /etc/yum.repos.d/mqtt.repo
$ sudo yum install mosquitto mosquitto-clients -y
# 如果上面的命令执行时报依赖缺少的错误，可以加上--skip-broken再执行一遍即可$ sudo yum install mosquitto mosquitto-clients -y --skip-broken

$ cd cert

$ cat Device_Certificate.crt CA_Certificate.pem > Device_CA_Certificate.crt

$ mosquitto_pub --cafile root-CA.crt --cert Device_CA_Certificate.crt --key Device.key -h xxxxxxxxxxxxxx.iot.cn-north-1.amazonaws.com.cn -p 8883 -q 1 -t JITR/test -i anyclientID --tls-version tlsv1.2 -m "Hello" -d

Client anyclientID sending CONNECTError: The connection was lost.

$ mosquitto_pub --cafile root-CA.crt --cert Device_CA_Certificate.crt --key Device.key -h xxxxxxxxxxxxxx.iot.cn-north-1.amazonaws.com.cn -p 8883 -q 1 -t JITR/test -i anyclientID --tls-version tlsv1.2 -m "Hello" -d

Client anyclientID sending CONNECTClient anyclientID received CONNACKClient anyclientID sending PUBLISH (d0, q1, r0, m1, 'JITR/test', ... (5 bytes))Client anyclientID received PUBACK (Mid: 1)Client anyclientID sending DISCONNECT

AWS 解决方案架构师，负责企业级客户的架构咨询及设计优化，同时致力于 AWS IoT 和存储服务在国内和全球企业客户的应用和推广。加入 AWS 之前在EMC研发中心担任系统工程师，对企业级存储应用的高可用架构，方案及性能调优有深入研究。


### AWS IoT 物联网系列其他博客目录如下：
[](https://amazonaws-china.com/cn/blogs/china/aws-iot-series-1/)
[](https://amazonaws-china.com/cn/blogs/china/aws-iot-series-2/)
[](https://amazonaws-china.com/cn/blogs/china/aws-iot-series-3/)
[](https://amazonaws-china.com/cn/blogs/china/aws-iot-series-4/)
[](https://amazonaws-china.com/cn/blogs/china/aws-iot-series-5/)
[](https://amazonaws-china.com/cn/blogs/china/aws-iot-series-6/)
[](https://amazonaws-china.com/cn/blogs/china/aws-iot-series-7/)
[](https://amazonaws-china.com/cn/blogs/china/aws-iot-series-8/)